SEC-01 · Security and Zero Trust
Trust nothing, prove everything, keep it fast.
Design a zero-trust access path from the policy engine to the compliance evidence, then build a gateway that enforces it at speed.
You build: a gateway design with a control-to-regulation map.
Prefer to be taught it live? Kernel CVE Triage & Attack Surface Reduction (SEC-101, 3 days) is the same material delivered in a scheduled cohort by an instructor, in person or online. See the live course · Live dates
Some chapters are still being completed — the chapters for this course are still being finalised.
Promise
Design a zero-trust access path and a high-performance gateway, from policy engine to compliance evidence.
Prerequisites
basic security; networking fundamentals.
Units
1. Zero-trust foundations ch 01–03, 05
the paradigm, reference architectures, identity, microsegmentation.
2. Gateway platform ch 06–09
platform choices, data plane, performance, policy engine.
3. Inspection and crypto ch 10–12
TLS performance, DPI and threat identification, logging and audit.
4. Observability and availability ch 13–15
monitoring, high availability and load balancing, cloud-native gateways.
5. Application security ch 16–18
API gateway, WAF, zero-trust network access.
6. Data and malware ch 19–20
DLP integration, sandboxing.
7. Performance and delivery ch 21–22, 23
benchmarking and tuning, automated deployment, secure development lifecycle.
8. Compliance and new environments ch 24–28
regulation mapping, multi-cloud, edge, IoT, AI in gateways.
9. Cases and future ch 29–30
.
Labs
Each lab names its environment and a pass check. Labs are not marked complete on "it ran" — the pass check has to hold.
| Lab | What you do | Environment |
|---|---|---|
| SEC-01ach 05 | Microsegmentation between three workloadsPass check: Only allowed pairs connect | vm90 min |
| SEC-01bch 09 | Policy evaluation with a default-deny enginePass check: Decisions logged | sim90 min |
| SEC-01cch 17 | WAF rule chainPass check: Attack blocked, normal request passes | sim90 min |
| SEC-01dch 18 | ZTNA access with mTLSPass check: Access granted only with a valid identity | container120 min |
Capstone project · CAP-05
Security Gateway Design with Compliance Map · 2 weeks
A regulated customer needs an access gateway for internal APIs.
Write the design: policy decision and enforcement points, data path, performance budget, and a control-to-regulation map for two clauses.
Deliverables: Design document, policy test suite, compliance map.
Outcomes
- I can draw a zero-trust access path and name the policy decision and enforcement points.
- I can write and test a policy that denies by default.
- I can map a control to a regulation and name the evidence to collect.
Also in
How it runs
Work through the units in order. Each unit groups the chapters of the study guide with its share of the labs. You can start any time; there is no cohort date and nothing expires.
Labs run in a VM, a container, a simulator or on real hardware, and the card above names which. Where a lab needs hardware — an RDMA NIC, a programmable switch model, an FPGA — there is a simulator fallback so you are never blocked by equipment.
Questions
Do I get a certificate?
You get a completion record for the course. Path badges and project credentials are earned by passing the labs and the project review, not by attendance.
Can my team take this together?
Yes — and if you would rather have it delivered live, with the instructor in the room, this course also exists as a scheduled live cohort. See the live dates.
How long does it take?
≈ 29 h of study including the labs. Most engineers take it part-time over a few weeks.